Linux vhost bug CVE-2026-74580 gives local root and a VM escape
CVE-2026-74580, a stale-cache flaw in the Linux kernel's vhost subsystem, gives local users root and — with a virtual IOMMU — lets a guest write into the host. Patched.
Newsroom
Microsoft, Health-ISAC seize domains behind 1B phishing messages
Microsoft's DCU and Health-ISAC seized domains for YAM Store, CoGUI and Iron Man — a Chinese-language phishing marketplace Microsoft ties to over 1 billion messages since January.
Nextcloud Collabora CODE RCE CVE-2026-110447 exploited
CVE-2026-110447 lets unauthenticated attackers run commands via the Collabora Built-in CODE app's proxy.php and plant web shells. Exploited since September; fix is in 26.4.303.
OpenAI engineer arrested over hidden office recording device
Abdulrahman Alfozan, an OpenAI engineer, was arrested after the company found a concealed audio recorder in an executive conference room and traced it to him. He faces up to five years.
Ahold Delhaize takes systems offline after cyberattack
Ahold Delhaize pulled systems offline on October 12 after a security incident, knocking out websites, apps and online grocery across Albert Heijn, Delhaize and US brands. Stores stayed open.
Docker Hub CVE-2026-105445 let tokens impersonate repo owners
A Docker Hub flaw (CVE-2026-105445) transferred personal access tokens during account-to-org conversions, letting an attacker push or delete images as another user. Fixed; no abuse found.
GitHub hardens npm trusted publishing after SlugFest flaw
GitHub tightened npm's trusted publishing after Bloom Security's 'SlugFest' showed claiming an abandoned repo slug could hijack 1,500+ packages. Unvalidated configs now expire in 48 hours.
Ivanti Connect Secure zero-days chained for root on patched VPN
Volexity found attackers chaining three Ivanti Connect Secure zero-days (incl. CVE-2026-104935) for root on a fully patched VPN. Two are patched; the root-escalation bug is not.
LG webOS TVs: pre-auth root chain from the local network, no CVE yet
A three-bug webOS chain disclosed by SSD gives root on LG smart TVs from the same LAN, with no PIN or owner action. LG has shipped a firmware fix; no CVEs assigned.